CVE-2024-6547 describes a Full Path Disclosure vulnerability in the Add Admin CSS WordPress plugin (versions up to 2.0.1). The issue arises from the plugin's use of bootstrap and the presence of test files with display_errors enabled, which expose the full filesystem path to unauthenticated attackers. This information disclosure is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability does not directly compromise confidentiality, integrity, or availability but may facilitate further attacks if other vulnerabilities exist.

The vulnerability allows unauthenticated attackers to obtain the full path of the web application on the server. This information disclosure is limited in impact by itself and does not directly lead to data loss or service disruption. However, it can aid attackers in crafting more effective attacks if other vulnerabilities are present on the affected site. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Add Admin CSS plugin if not essential. Additionally, ensure that PHP error display is disabled in production environments to prevent information leakage. Monitor the vendor's communications for updates regarding a patch or official mitigation.